From nobody Wed Oct 07 06:24:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j034d2kFpz6vMbt for ; Wed, 07 Oct 2026 06:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j034d2102z3MlH for ; Wed, 07 Oct 2026 06:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791354273; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zN82IVF+hLCdLGTIurIOthCmq32DIt3cRuzHdEP5IAg=; b=daZE9aJKaDUmr1n2sUKrUW3KIm+jqvTnNNFg0K42bitZ49AL7fx2jsDqbxr5tq5zwioVA5 boTf4rB+mr1ycEgrZi+ow6rOw/j+/TSflGGtFCrAVFFGVg8k6u8GLvo4Y85nwtJC5QH3EK tkMtfXfoavqXEonuaqvwjbBrl7+OUVt5YdxplO+eu+TUvDT21HB4OY5nFyfYVZ7h+C/lKU zTwEe78UjVESiPuM4OY1hGyjWC8v/6eSt6VCAO/fvYrBbSyx2o+NrbTRb6XVZjT1j/P+9p vZpGxtmIQDK+Nt8UXNpYkaJuDymXFUK6qA1G6nr2FTMI40k7Q+39FkNyFHu3xA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791354273; b=xYkigBdcjc7foqmU2H0DZO6xnYIzKYzAAlOVPtT1vxeX5UgXEtQU0M0Rpo2wAnDWUVeDjo +lYcnDs7D+sAIc2+3LWLmX3acxx9PWWaxNNtlb1K5r72GZThkjrAsSnm7H1gTcEcJiW1nE CD5WYfsK6T7RaT+20coBMaZipGNspgeyNXIz1YOwtCH2e6nDpT/RUnrqVdkOiLUeRpTcA8 YqU3UlvVC+jJUyuquZo5lX45OpfYDBaIQnjVYZ5x0fmeMeSknb+KeYefnxYgT9/500U8pV pJIWuqHKjTnH1Su5A9lXMpZvva75YpzOgOfG2C0MMxe5UGXhBeDvwlqHUSAgAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791354273; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zN82IVF+hLCdLGTIurIOthCmq32DIt3cRuzHdEP5IAg=; b=EO50m6VDpQWBbc97PVx0tW1rh14s4D/puCf9mPyjMmxeYVe3K7ro8vwDMD7K+onEnAtiEX X27Uv+/3ZVqInAiEvFMFCbYWR63ScuUtdrwGBc6ooqFoq9IEYC9EE+z3NYHhg9lI7BA5fp Nv2sSaHnsu3a0zg9xH+qk6SnMtiihdL4u1E54zZ7zwMHLTIVrYwWj9PJE1pDQngo8Jt31a LbAREw0+uGi6sHVAXzZwkr28uTmDUk1jbs/HuvbA6RDPcrPVftNy3dVu5c9iDDGDPqx5Ri IcJP08J1g6P3KYtYspzYW7Z5XsRAQmiz9cv9Nl8vBX6G84FvBNMWBCYueIlwwA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j034d0VVbzhR8 for ; Wed, 07 Oct 2026 06:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 42361 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 07 Oct 2026 06:24:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Christos Margiolis Subject: git: b1aea70753bc - stable/15 - cuse: Fix hang on readv(2) and writev(2) with multiple iovecs List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: b1aea70753bca974af6b8e4814aecd1aaff29e2a Auto-Submitted: auto-generated Date: Wed, 07 Oct 2026 06:24:32 +0000 Message-Id: <6ac5e5a0.42361.2fe8d992@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=b1aea70753bca974af6b8e4814aecd1aaff29e2a commit b1aea70753bca974af6b8e4814aecd1aaff29e2a Author: Christos Margiolis AuthorDate: 2026-09-30 09:49:35 +0000 Commit: Christos Margiolis CommitDate: 2026-10-07 06:23:31 +0000 cuse: Fix hang on readv(2) and writev(2) with multiple iovecs uiomove() leaves an iovec it has just emptied as the current one, so cuse_client_read() and cuse_client_write() picked it up again on the next iteration, sent the server a zero-length command, and got zero bytes back. That left the residual count unchanged, so the loop never terminated and the call never returned. Step past empty iovecs at the start of every iteration. This also covers caller-supplied zero-length iovecs, which hung in the same way PR: 293489 MFC after: 1 week Sponsored by: The FreeBSD Foundation Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D59822 (cherry picked from commit 872c36cb6f2de17278c559a300c2163d8b39b3c6) --- sys/fs/cuse/cuse.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/sys/fs/cuse/cuse.c b/sys/fs/cuse/cuse.c index ef786d125c15..c6107b977dac 100644 --- a/sys/fs/cuse/cuse.c +++ b/sys/fs/cuse/cuse.c @@ -1666,11 +1666,21 @@ cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag) cuse_cmd_lock(pccmd); while (uio->uio_resid != 0) { - if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { + len = uio->uio_iov->iov_len; + /* + * The uiomove() below does not step past an iovec it has + * just emptied, so do it here, to avoid an infinite loop + * where we are requesting zero-byte transfers. + */ + if (len == 0) { + uio->uio_iov++; + uio->uio_iovcnt--; + continue; + } + if (len > CUSE_LENGTH_MAX) { error = ENOMEM; break; } - len = uio->uio_iov->iov_len; cuse_server_lock(pcs); if (len <= CUSE_COPY_BUFFER_MAX) { @@ -1754,11 +1764,21 @@ cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag) cuse_cmd_lock(pccmd); while (uio->uio_resid != 0) { - if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { + len = uio->uio_iov->iov_len; + /* + * The uiomove() below does not step past an iovec it has + * just emptied, so do it here, to avoid an infinite loop + * where we are requesting zero-byte transfers. + */ + if (len == 0) { + uio->uio_iov++; + uio->uio_iovcnt--; + continue; + } + if (len > CUSE_LENGTH_MAX) { error = ENOMEM; break; } - len = uio->uio_iov->iov_len; if (len <= CUSE_COPY_BUFFER_MAX) { error = copyin(uio->uio_iov->iov_base,